Final exam

Could you please share your name and company email address? Thanks!

1 / 30

How can you visualize your security posture over time?

By looking at the "MITRE ATTACK Risk" report

by clicking on the stop watch icon on the Insights page

By adding the Trend line widget to a dashboard

By inserting the exported simulations data to an Excel table

2 / 30

Where can I find my overall security score?

On the "Scenarios" page, under "Overall"

On the homepage - "Security Posture Optimizer"

At the bottom of the main screen of the application

On the left panel, under "Environment"

3 / 30

How can you present summarized information to your managers? (Select 2)

Create a SafeBreach account for them and send them the credentials

By printing out-of-the-box reports or saving them as PDFs

By creating a dashboard with the data they are interested in

By installing a simulator on their computer

4 / 30

What benefits does rerunning tests provide?(Select 3)

To measure the security posture over time

To save some time running the same tests manually again and again

To create a continuous measurement of the security posture

To boost the tests running time

5 / 30

What is "Breach and Attack Simulation" (BAS)?

"Behavioral Anomaly Scanner," a software tool designed to detect unusual behavior patterns in network traffic indicative of potential security threats

"Binary Authentication System," a security mechanism used to verify the authenticity of executable files and prevent malware from executing on a system

"Breach and Attack Simulation," which is a cybersecurity technique used to simulate cyber attacks and assess the security posture of a network or system

"Blockchain Assurance Service," a cybersecurity service leveraging blockchain technology to provide immutable records of security events and enhance auditability in digital environments

6 / 30

Where can you see your simulators’ locations?

At the bottom of the "Insights" page

On the "Grid Management" screen, under "Environment"

On the "Deployment Status" report

Under the big circle at the Security Posture Optimizer screen

7 / 30

How can you find the latest US-CERT alert threat?

It will appear on the top left corner of the "Scenarios" page

It will be displayed on the "Insights" page

You can always find a shortcut on the MITRE ATTACK Risk report

It will appear in the middle of the circle on the security posture optimizer

8 / 30

Why would you want to integrate a Vulnerability Management platform into SafeBreach?

In order to maintain a clean security posture over time

In order to prioritize vulnerabilities by exploitability and impact based on SafeBreach simulations

In order to keep it up-to-date

In order to sync your existing SIEM to attack simulation

9 / 30

What is the first integration to be connected?

Threat intelligence. They help SafeBreach by providing additional attacks to the playbook

SIEM. It helps SafeBreach identify the attacks status (missed/detected etc.)

Firewalls. They can help SafeBreach to identify network gaps and increase the data flow between networks

Workflow and automation tools. They can help you by notifying you when an attack scenario was finished

10 / 30

What is correct about IOC-based remediation?

IOC-based remediation involves identifying and responding to specific indicators of compromise (IOCs) within a system to detect and mitigate cyber threats

IOC-based remediation focuses solely on updating antivirus signatures to detect and block known threats

IOC-based remediation relies on heuristic analysis to predict future cyber attacks based on historical data

IOC-based remediation involves encrypting all data transmissions to prevent unauthorized access to sensitive information

11 / 30

What gap can you identify using the "Breach Explorer"?

The number of attacks for a component to collapse

The most exploited MITRE techniques

The number of steps it takes for an external attacker to reach your internal sensitive components

The easiest ways for an attacker to reach the SafeBreach platform server

12 / 30

What is correct about "Behavioral Remediation"?

Behavioral remediation focuses on identifying unusual or suspicious activities and patterns that might not be documented as IOCs

Behavioral remediation relies solely on known Indicators of Compromise (IOCs) to detect and mitigate cyber threats

Behavioral remediation primarily targets known vulnerabilities in software and systems to prevent potential attacks

Behavioral remediation focuses exclusively on strengthening network perimeter defenses to prevent unauthorized access, rather than detecting internal threats

13 / 30

How can we simulate attacks within the organization`s network?

By deploying vulnerable software on the network and waiting for external attackers to exploit them

By making the installed simulators attack each other using different techniques and paths

By conducting penetration testing with the help of external security experts to identify vulnerabilities

By relying solely on theoretical models and simulations without any practical implementation within the network infrastructure

14 / 30

What is the Playbook?

A collection of the scenarios built by SafeBreach Labs

An inclusive name for the MITRE ATTACK library scenarios

A collection of more than 30,000 breach methods which can be added to an attack scenario

An organization of independent ethical hackers around the world

15 / 30

How can users access the remediation data needed for blacklisting commands or blocking ports?

Creating an automation with SafeBreach automations, under the "Environment" tab

Creating an automated scenario in the SafeBreach Studio

Copying a query from the "Insights" page and pasting it in your relevant security control

Copying the ports from the specific attack you want to remediate, under "Attack Summay"

16 / 30

What is the purpose of the collector?

It delivers malicious email to the external attacker

It allows data flow from the platform to the SIEMs

It aggregates data from on-prem security controls and transfers it safely to the cloud using one port

It aggregates stolen passwords from networks all over the organization

17 / 30

What is best practice for deploying the simulators across the organization?

Representatively, so you can differentiate between DMZ, machine types etc.

Two simulators on every machine in the network

One simulator in each network of the organization

One simulator in each country or server location

18 / 30

Workflow and automation integrations allow you to:

Monitor the data flow of the organization

Receive notifications and updates via email, Slack etc.

Connect your SIEM to your threat intelligence service

Send data from your SIEM directly to SafeBreach

19 / 30

How can you run only attacks relevant to your type of industry?

By filtering the playbook to a specific industry

By running a query in Splunk

By choosing "Attack Vector" while creating an attack in the Studio

By contacting SafeBreach support bot

20 / 30

What is the automated analysis correlation process?

It aggregates data from various sources to generate reports on network performance

It analyzes user behavior to identify patterns indicative of potential insider threats

It's Responsible for matching the events fetched from the security controls and the SIEM to SafeBreach events, to detect the success or failure of attacks

It encrypts sensitive data transmitted across the network to protect against interception by attackers

21 / 30

How can you test your defense against the latest threats? (Select 2)

By importing threats from your integrated Threat Intelligence services

By clicking on the "Rerun" button on the simulation results page

By choosing them from the "Known Threats Series" section on the Scenarios page

SafeBreach can only test defenses from threats older than a week

22 / 30

Why is it important to assign data assets to simulators?

To protect your data assets against unwanted breaches

To direct SafeBreach to attack the important components

To identify security breaches in the organization

So SafeBreach knows the location of your assets

23 / 30

Why should you assign different roles to different simulators?

To run attacks using users with different privillege levels

To run attacks on different machines in the organization

To enhance the security posture over time

To enlarge the network bandwidth so that more data will be sent from the simulators

24 / 30

How does SafeBreach allow you to check how your network segmentation is performing?

By using the external attacker provided by SafeBreach

By deploying a simulator on every one of the organization's devices

By running the same infiltration attack on every DMZ of the organization

By deploying simulators in every segment and running lateral movement attacks

25 / 30

On which operating systems you can install simulators?

Only Windows and windows server

Windows server 2017 and above

Linux, Mac and Windows

Mac and Windows

26 / 30

What are "Advanced Actions"?

Sophisticated algorithms used to optimize network traffic flow

Advanced actions refer to the latest advancements in virtual reality technology for gaming

Simulations that take realism to the next level and can generate a certain impact on the environment

specialized encryption techniques used to secure communication channels

27 / 30

What are APT's?

"Automated Patch Testing" mechanisms used to validate software updates for vulnerabilities before deployment

"Advanced Persistent Threats", are sophisticated and continuous cyber attacks launched by highly skilled adversaries, often with specific targets and long-term objectives

"Automated Password Transfers", a feature in cybersecurity tools that securely stores and transfers passwords across different systems

"Advanced Protection Techniques", a set of security measures implemented to defend against common cyber threats and malware attacks

28 / 30

Why should you add your simulators to an allowlist?

They can cause damage to critical systems if you won't do so

To allow the data flow between the simulators

Allowlisting the simulator files will increase the accuracy of the security posture score

They could be detected as malicious by most of the security controls

29 / 30

Why is it beneficial to integrate your SIEM to the SafeBreach platform?

It ensures the safety of the attacks

It unlocks high-risk attack features

It supports the platform in the attack status identification process

It prevents unwanted crashes on the platform

30 / 30

How can you hand over the aggregated hashes and ports for remediation to the IT team?

Are You Ready?